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We give a (remote) quantum gambling scheme that makes 
use of the fact that quantum nonorthogonal states cannot 
be distinguished with certainty. In the proposed scheme, two 
participants Alice and Bob can be regarded as playing a game 
of making guesses on identities of quantum states that are in 
one of two given nonorthogonal states: if Bob makes a correct 
(an incorrect) guess on the identity of a quantum state that 
Alice has sent, he wins (loses). It is shown that the proposed 
scheme is secure against the nonentanglement attack. It can 
also be shown heuristically that the scheme is secure in the 
case of the entanglement attack. 

03.67.Dd 

A fundamental property of quantum bits (qubits) that 
differs from those of classical bits is that unknown qubits 
cannot be copied with unit efficiency Jj],0] (the no-cloning 
theorem). Another related property of qubits is that 
nonorthogonal qubits cannot be distinguished with cer- 
tainty [|]-[|. The no-cloning theorem is the basis for 
the success of the Bennett-Brassard 1984 quantum-key- 
distribution scheme ||. Therefore, it is interesting to 
search for quantum protocols utilizing the property that 
nonorthogonal qubits cannot be distinguished with cer- 
tainty. Bennett's other quantum- key-distribution scheme 
indeed utilizes this property. On the other hand, a 
(remote) quantum gambling scheme has been found by 
Goldenberg et al. recently PJ. 

In this paper we propose another (remote) quantum 
gambling scheme that makes use of the fact that two 
nonorthogonal qubits cannot be distinguished with cer- 
tainty. In the proposed scheme, two participants Alice 
and Bob can be regarded as playing a game of mak- 
ing guesses on identities of quantum states that are 
in one of two given nonorthogonal states; Alice ran- 
domly sends one of two nonorthogonal qubits, say, |0) 
and |0). [In this paper, |0) = (1/V2)(|0) + |1)) and 
|1> = (1/V2)(|0) - |1)).] If Bob makes a correct guess, he 
wins. If not, he loses. Due to the fact that two nonorthog- 
onal qubits cannot be distinguished with certainty, it is 
easy to see that there is no way for Bob to cheat. Alice 
might try to increase her gain by sending some qubits 
other than |0) and |0). There are two kinds of attacks. 
In nonentanglement attacks, qubits sent to Bob are not 
entangled with Alice's. In entanglement attacks [ ^2|Jl3| 
(or EPR attack), qubits sent to Bob are highly entan- 
gled with hers. We show that the scheme is secure in 
the case of nonentanglement attacks. In the case of en- 
tanglement attacks, however, we heuristically show the 



security of the scheme. It is true that a quantum cryp- 
tographic scheme is of little use without security proof 
against all attacks including entanglement attacks. And 
what makes it complicated to prove security of a quantum 
cryptographic scheme is the entanglement attack Jl2],[l3| . 
Our security proof of the scheme against the entangle- 
ment attack is heuristic. However, since the idea behind 
the proof is simple, we believe that a rigorous one will be 
found, like in the case of the quantum key distributions 
0-0. 

The difference between our scheme and the original 
one |ll]] is that the former relies on the fact that two 
nonorthogonal states cannot be distinguished with cer- 
tainty while the latter relies on gerneral quantum me- 
chanical laws.d Another difference is that no quantum 
system needs to be additionally sent in checking steps in 
our scheme while it needs to be in the original scheme. 

Now, let us describe the scheme more precisely. 

(1) Alice randomly chooses one between two nonorthog- 
onal qubits |0) and |0), and sends it to Bob p8[ . 

(2) On the qubit he receives, Bob performs a measure- 
ment by which he can obtain maximal probability p of 
correctly guessing the identity of the qubit. 

(3) On basis of the measurement's results, he makes a 
guess on which one the qubit is and announces it to Al- 
ice. 

(4) If he made a correct (an incorrect) guess, Alice an- 
nounces he has won (lost). 

(5) When Bob has won, Alice gives him one coin. When 
he has lost, Bob gives her p/(l — p) coins. 

However, after the first step, Bob follows the following 
ones instead of steps (2) — (5), at randomly chosen in- 
stances with a rate r(0<r<l). 

(These checking steps are similar to those of the original 
work of Goldenberg et al. pi] .) 

(2') Bob performs no measurement on the qubit and 
stores it. 

(3') He announces his randomly chosen guess on identity 
of the qubit. 

(4') Do the same thing as step (4). 

(5') In the previous step, Alice has actually revealed 
which one she chose to tell him the qubit is (regardless 
of her honesty). When it is |0), Bob performs S z (S z 
an orthogonal measurement that composes of two pro- 
jection operators |0)(0| and |1)(1| or {|0)(0|, |1)(1|}.) If 
the outcome is |1), Bob announces that he performed S z 
and got |1) as an outcome. Then Alice must give him 
R (» 1) coins. If the outcome is |0), Bob says nothing 
about which measurement he performed and follows step 
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(5). In the case of |0), similar things are done with S x 

(={|o)(0|,|i)(i|}). 

In step (2), it is important for Bob to perform the op- 
timal measurement that assures maximal probability p 
of correctly guessing the identity of the qubit in order to 
assure his maximal gain. Although it is known that aver- 
age information gain is constrained by the Levitin-Holcvo 
bound ||j§,[l9| j to find the optimal one is not an easy task. 
Fortunately, however, in the case of two nonorthogo- 
nal qubits, the measurement giving maximal information 
gain is well known j7tf|: a measurement {|0)(0|, |1)(1|}, 
where |0) and |1) are qubits corresponding to a vector 
(l/y/2)(z — x) and (l/v2)(— z + x), respectively, in the 
Bloch sphere representation, where a single qubit density 
operator^ = (l/2)(l+f •<?). Here 1 is the identity oper- 
ator, f is a Bloch vector, a = (a x , a y , a z ), and a x , a y , a z 
are the Pauli operators. (See Fig. 1 of Ref. or Fig. 
2 of Ref. ||.) Since information gain is maximal if and 
only if p is maximal, a measurement with maximal infor- 
mation gain is what maximizes p. Thus the measurement 
{|0)(0|, |1)(1|} is the optimal one. For maximal p, Bob 
does as the following. When the outcome is |0) (|1)), 
he makes a guess that the qubit is |0) (|0)). Then the 
probability p of correctly guessing the qubit is given by 
P =|(6|0}| 2 = |(l|l)| 2 =cos 2 (V8). 

Now let us show how each player's average gain is as- 
sured. First it is clear by definition that Bob can do noth- 
ing better than performing the optimal measurement, as 
long as Alice prepares the specified qubits. In the scheme, 
the numbers of coins that Alice and Bob pay are ad- 
justed so that no one gains when Bob's win probability 
is p. Thus Bob's gain Gb cannot be greater than zero, 
that is, Gb < 0. Next let us consider Alice's strategy. As 
noted above, we first show the security against nonentan- 
glement attacks. In the most general nonentanglement 
attacks, Alice randomly generates each qubit in state \i) 
with a probability pi. Here |i)'s are arbitrarily specified 
states of qubits, i = 1, 2, N and J2i Pi = 1- However, 
since Bob has no knowledge about which \i) Alice se- 
lected at each instance, his treatments on qubits become 
equal for all qubits. Thus it is sufficient to show the se- 
curity for a qubit in an arbitrary state \j) = a\0) + b\l). 
(a and b are some complex numbers with a constraint 
| a. | 2 + \b\ 2 = 1.) First we do it for states within the z- 
x plane, \j) = cos(0/2)|O) + sin(0/2)|l). Later we will 
generalize the argument to the former case. Let us con- 
sider the following. In steps (2') — (5'), Bob checks at 
randomly chosen instances whether Alice has really sent 
|0) or |0) by performing measurements S z or S z , respec- 
tively. If the measurement's outcomes are |0) or |0) (|1) 
or |1)), Alice has passed (not passed) the test. When not 
passed, Alice must give him i?(^ 1) coins p0| . 

Roughly speaking, Alice can do nothing but preparing 
either |0) or |0) and honestly tell the identity of the state 
to him later. Otherwise she sometimes must pay R coins 



to him, decreasing her gain. Let us consider this point 
more precisely. First we estimate the upper bound of 
Alice's gain Ga- It is clear that 

G A <mzx{G A ,G A }, (1) 

where max{x, y} denotes the maximal one between x and 
y, and G A (G A ) is Alice's gain when she insists that \j) 
is |0) (|0)). When he has performed the measurements 
already, he has no way of detecting Alice's cheating. So, 
Alice's maximal gain in this case is p/(l — p). However, 
it is clear that G a is bounded by p/(l — p) in any case. 
When he has preserved the qubits following the check- 
ing steps, Alice's cheating can be statistically detected. 
This case contributes to Alice's gain by a largely nega- 
tive term whose modulus is proportional to the product 
of the rate r of checking steps, the probability that |1) or 
1 1) is detected, and the number of coins R she must pay 
when it is detected, namely —r\(\\j)\ 2 R or —r\(l\j)\ 2 R. 
However, here we should take into account the fact that 
Alice obtains partial information about whether Bob has 
performed the measurement: let f u be Alice's estimation 
of the probability that Bob did not perform the measure- 
ment. With no information, f u is r. However, Bob's an- 
nounced guess gives her partial information on his mea- 
surement's result if he did. This information can be used 
to make a better estimate of f u . For example, in the case 
where Alice sends \ j) and Bob performs the optimal mea- 
surement {|0)(0|, we obtain using the Bayes's rule 
that /„ = (r/2)/[(r/2) + (1 - r)|(0|j)| 2 ] when his guess 
is |0). However, it is clear that f u > r/2: when Bob 
did not perform the measurement, he simply guesses it 
with equal probabilities regardless of what he received. 
Thus by the Bayes's rule, Alice can see that there re- 
mains a probability greater than r/2 that Bob did not 
perform the measurement. The relation f u > r/2 also 
holds for the entanglement attacks, since it is satisfied for 
any \j) as shown above (refer to the related discussion on 
entanglement-attack later). Combining above facts, we 
obtain 

G A <Y^- p -\\{l\j)\ 2 R (2) 

and 

G\<^-- r -\{l\j)\ 2 R, (3) 
I— p 2 

From Eqs. (|l|)-(j^), we can see, in order that Ga be non- 
negative the following two conditions must be satisfied. 
(1_) Either |(l|j)| 2 - (1/rR) < 1 (that is, \j) - |0» or 
|(l|j)| 2 ~ (1/rR) < 1 (that is, \j) - |0)); (2) Between 
|0) and |0), Alice chooses what is nearer to \ Then she 
pretends in the step (4)'s that it is the qubit sent to Bob. 
Otherwise, Ga will be dominated by the negative second 
term in the right-hand sides of Eqs. (||) and (^). 

Alice might increase her gain by sending a qubit that 
slightly differs from either |0) or |0). However, the gain 
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can be made negligible by making R large, as we show 
in the following. Let us consider the case where Alice 
prepares |j) (~ |0)) and later tells him that it is |0), for 
example. In this case, G a for a given r and R is given 
I'.v 

G A = (l-r){|(0|j)| 2 (-l) + |(i|j)| 2 -^} 

1-p 

-r\{l\j)\ 2 R + r\{0\j)\ 2 d(-l) + l-V-} 
2 2 1 — p 

< (1 - r){[cos(^ + 9 -)f(-l) + [smq + 5)]^} 



-r(sin-) 2 i? + 3r. 



(4) 



Here the first (second and third) term in the right-hand 
sides is due to normal steps (1) — (5) [checking steps (2') — 
(5')]. We can check Eq. (|j) by verifying that Ga < 3r ~ 
when \j) equals |0). By the two conditions, we might 
only consider the case where 9 ~ 0, and thus we can 
neglect higher-order terms in Eq. (|J), 



G A < 



rR 



1-p 



3r, 



(5) 



where a — cos(7r/8) sin(7r/8) and a small term of order 
9 2 is also neglected. Alice would maximize her gain for 
given r and R. Maximal value of Ga is obtained when 
9 = (2a/[l-p})(l/rR). 
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(1-p) 2 rR 



+ 3r. 



(6) 



Bob would minimize G™ aa: 



GJ ax has 



for a given R. 
its minimal value 2\/3a/[(l — p)\/~R\ when r = a/[{l — 
p)\j3R]. Therefore, if Bob chooses r = a/[(l — p)\ // 3R] 
then Ga is bounded by the positive term 2\J~3a/[(\ — 
p)VR\ oc \/\/~R that approaches to zero as R become 
large, similarly to the case of the scheme of Goldenberg 
et al. Q. 

Now we argue that using a qubit outside the z-x plane 
does not increase Alice's gain: we can see in Eq. (Q) 
that Ga can only be increased by making the ratio 
|(l|j)| 2 /|(0|j)| 2 large while keeping |(l|j)| 2 a very small 
constant. Let us consider some set of \j)'s (not confined 
in the z-x plane) that give the same value of |(l|j)| 2 . 
Bloch vectors of this set make a circle around that of 
|1). We can see by inspection that what gives the maxi- 
mal value of the ratio |(l|j)| 2 /|(0|j)| 2 lies within the z-x 
plane. 

Now, let us heuristically argue that the entanglement 
attacks HIT! do not work in the proposed scheme. Let 
us consider the case where Alice prepares pairs of qubits 
in an entangled state, 



= -^=(10)^10)3 + 11)^10); 



(7) 



where A and B denote Alice and Bob, respectively. Al- 
ice sends qubits with label B to Bob while storing those 
with label A. If she performs S z , Bob is given a mixture 
of |0) and |0) with equal frequency. Thus if Alice always 
performs S z , the attack reduces to a nonentanglement 
attack where she randomly sends either |0) or |0). Let 
us consider an example illustrating how performing mea- 
surements much different from S z is not of benefit for 
Alice; we can rewrite Eq. (R) as 



V2 + V2 



\0)a\<x)b 



\/2- \/2 



|1}a|/?)b, (8) 



where \a) and |/3) are normalized ones of (|0) + |0)) and 
(|0) — |0)), respectively. Thus if Alice performs S x , ei- 
ther | a) or |/3) is generated at Bob's site with probabil- 
ities given by Eq. (||). However, since all of |(l|a)| 2 , 
|(l|a)| 2 , |(1|/3)| 2 , and |(1|/3)| 2 are of order of one, G A be- 
comes much negative in any case. So Alice would not 
perform S x . In fact, if Alice is able to change the qubits 
between |0) and |0) as she likes, her cheating will al- 
ways be successful. However, she is not allowed to do so, 
since |0)(0| ^ |0)(0| and Bob's reduced density operator 
Pb{~ ^a[pab\) cannot be changed even with entangle- 
ment attacks. 

By appropriately choosing her measurement, Alice 
can generate at Bob's site any satisfying 
*52iPi\i){i\ = Pb, where denotes a mixture 

of pure states with relative frequency pi (the the- 
orem of Houghston, Jozsa, and Wootters) (2lj. Let 
Pb = (l/2)(l + f ■ <t). Since p B = J2iPi\i){i\ and = 
(1/2)(1 + fi ■ (?) where fi is the corresponding Bloch vec- 
tor, we have (1/2) (1 + r ■ a) = (1/2) (1 + ^ Pih] ' °) and 
thus 



E 



Pin 



(9) 



Therefore, for a given ps whose Bloch vector is f, Al- 
ice can prepare at Bob's site any mixture fej«)(*|} as 
long as its Bloch vectors fi satisfy the Eq. (|j). How- 
ever, if Alice always performs a given measurement, the 
entanglement attacks reduce to the nonentanglement at- 
tacks: outcomes of measurements on entangled pairs do 
not depend on temporal order of the two participants' 
measurements. So we can confine ourselves to the case 
where Alice measures first. Then the attack reduces to 
a nonentanglement attack where Alice generates \i) with 
probability pi. Alice can only utilize the entanglement 
by choosing her measurements according to Bob's an- 
nounced guesses. However, the checking steps also pre- 
vent Alice from increasing her gain: she must choose the 
measurement that gives some mixture {pt, at Bob's 

site where each fi is nearly the same as either z or x. Oth- 
erwise Ga becomes dominated by a much negative term 
involving rR. Therefore, Alice's freedom in the choice of 
measurements is negligible and thus she can increase her 
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gain by negligible amounts even with the entanglement 
attacks. 

Although the proposed scheme can be implemented 
with currently available technologies, it is very sensitive 
to errors. So before methods for reducing decoherence, 
e.g., quantum error correcting codes |2^| or decoherence- 
free subspaces 23 are realized with high performance, 
the proposed scheme seems to be impractical. And even 
if such methods are available, errors will remain to be 
generated with a small rate. Alice might insist that all 
errors are the residual ones and would not give him the 
R coins. Bob's practical solution to this problem is that 
he aborts the whole protocol if the error rate is greater 
than the expected residual error rate, as suggested in the 
original work PH| . Despite these difficulties, however, 
it is worthwhile to have another application of the fun- 
damental property that nonorthogonal qubits cannot be 
distinguished with certainty |§-f§. 

In conclusion, we have given another (remote) quan- 
tum gambling scheme that makes use of the fact that 
nonorthogonal states cannot be distinguished with cer- 
tainty. In the proposed scheme, two participants Alice 
and Bob can be regarded as playing a game of making 
guesses on identities of quantum states that are in one of 
two given nonorthogonal states: if Bob makes a correct 
(an incorrect) guess on the identity of a quantum state 
that Alice has sent, he wins (loses). It was shown that 
the proposed scheme is secure against the nonentangle- 
ment attack. It could also be shown heuristically that the 
scheme is secure in the case of the entanglement attack. 
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